Action execution based on management controller action request

ABSTRACT

Techniques for action execution based on management controller received action requests are provided. In one aspect, a utility program running under the control of an operating system on a server computer may retrieve an indication of an action request. The action request may be stored in a management controller accessible storage. Storage of the action request may not require operating system administrator credentials. The action specified in the request may be executed by the utility program.

BACKGROUND

Computing systems utilize various software components. For example, lowlevel firmware to interface with the hardware and drivers for hardwarethat may interface with an operating system. In some cases, it may benecessary to update the firmware or drivers on a computing system. Forexample, updates may provide additional capabilities. As anotherexample, updates may correct errors, often referred to as bugs, inprevious versions of the firmware or drivers.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an example of a system that may utilize management controlleraction requests according to the techniques described herein.

FIG. 2 is another example of a system that may utilize managementcontroller action requests according to the techniques described herein.

FIG. 3 is an example of a high level flow diagram for receiving andexecuting an action according to the techniques described herein.

FIG. 4 is another example of a high level flow diagram for receiving andexecuting an action according to the techniques described herein.

FIG. 5 is an example of a high level flow diagram for updating operatingsystem driver updates according to the techniques described herein.

FIG. 6 is another example of a high level flow diagram for updatingoperating system driver updates according to the techniques describedherein.

DETAILED DESCRIPTION

One process for updating firmware, drivers, or configurations on acomputing system, such as a server computer, may involve logging intothe Operating System (OS) of the computer system using an accountcredential that grants administrator privileges. The administrator,often referred to as the root user, or superuser, is granted privilegeson the computer system that may exceed those that are available to ageneral user account. For example, execution of certain programs on thesystem may be limited to users that have administrator privileges.Included in those privileges may be the authority to perform updates onthe firmware and/or drivers or to make configuration changes on thecomputer system. For purposes of this description, administratorcredentials or operating system administrator credentials, refers to thecredentials needed to log into a computer system as an administrator,and thus be granted administrator privileges.

A user logged in as an administrator may then download any software usedin updating the firmware and/or drivers. This downloaded data may bereferred to as an update package, as it may include the data used toperform the firmware and/or driver update. This data may include anexecutable program that actually performs the update. The update packagemay be downloaded to the server computer over a network. Theadministrator user may then update the desired components or performconfiguration updates on the computer. For the remainder of thisdisclosure, the term update or updating refers to updating of firmwareand/or drivers, as well as altering the configuration of a servercomputer.

Several issues may arise when using the process described above. First,as mentioned above, a user with administrator credentials may be grantedprivileges on the computer system that exceed those of a normal user andmay include privileges that go beyond those needed for updating thesystem. So, in order to allow a user to update the system, that user mayreceive the administrator credentials. However an issue arises in thatby granting administrator privileges in order to update the system, alladministrator privileges are granted as well. This is sub-optimalbecause a user that is responsible for updating the system, in manycases, should not be granted all the privileges associated with theadministrator.

Another issue that arises is that often times the updating of the systemmay interfere with normal operation of the system. For example,performing an update may reduce the responsiveness of the system. Insome cases, the update process may require that the system be restarted.These operations may impact the workloads that are being processed bythe server. For example, in the cases where the server is restarted,that server is no longer available during the restart period. In somecases, one user may be responsible for updates, while another user isresponsible for keeping the server available. It is difficult for bothusers to carry out their respective responsibilities if the user incharge of updates is able to affect the availability of the server,without input from the user responsible for maintaining the server'savailability. Even though affecting the availability of the server whenperforming an update may be unavoidable, the user responsible formaintaining system availability may desire to have control over whenthat period of reduced availability occurs.

As yet another issue, if the download of an update package occurs overthe same network that is being utilized by the server to processworkloads, the available bandwidth on that network is reduced. Thus,downloading an update package may in and of itself interfere with theserver's ability to process workloads.

The techniques described herein overcome these issues through the use ofa utility program running on the server, in conjunction with amanagement controller and a storage device that is accessible to boththe management controller and the processor on the server. A userresponsible for updates may store or otherwise provide data indicativeof the need for an update to a management controller. Providing the dataindicative of the need to update may not require administratorcredentials. The utility program, which may run as a program withadministrator privileges, may detect the presence of the data indicativeof the need for an update. In some implementations, the detection may bethrough periodic checks for the presence of the data indicative of theneed for an update. The time and frequency of the utility programchecking for the need to update may be controlled by a user responsiblefor maintaining availability of the system.

The update package may be downloaded to the system over a managementnetwork connected to the management controller. Thus, no bandwidth onthe network used to process the server workload is used. The utilityprogram may then determine when the update is to be applied, includingdetermining when any restart of the system, if needed, occurs. Thus,availability of the system remains under control of the utility program,which in turn is configured by a user responsible for maintaining systemavailability. These techniques are described in further detail below andin conjunction with the appended figures.

FIG. 1 is an example of a system that may utilize management controlleraction requests according to the techniques described herein. System 100may include a production network 110, a management network 120, aprocessor 130, a management controller 150 and a storage device 160. Theprocessor 130 may be coupled to the production network. The productionnetwork may be utilized by the processor for executing workloads. Thenetwork may be a local area network, a wide area network, an intranet,or the Internet. The techniques described herein are not dependent onany particular type of production network. What should be understood isthat the production network may be utilized in conjunction with theprocessor executing workloads assigned to the processor.

The processor 130 may be any type of processor that is included in acomputer. For example, the processor may be a processor included in aserver computer that executes instructions that allow the processor toprocess workloads. These instructions may include Operating Systeminstructions. The processor may be coupled to a management controller150. The management controller may itself be a processor, however themanagement controller may be used in the management of the processor.The management controller may not be used in the execution of workloads.The management controller may sometimes be referred to as a baseboardmanagement controller or a lights out controller.

The management controller may be coupled to a storage device 160. Thestorage device may be any type of device capable of storing an actionrequest 161. One example of a storage device may include a non-volatilememory, such as a flash memory, although techniques described herein arenot dependent on any particular type of storage device. An actionrequest may be an indication that an action is to be performed. Forexample, an action request may be a file, such as a script, whichindicates that an action, such as an update action is to be performed.An action request may also be a command received by the managementcontroller.

The management controller may be coupled to a management network 120.The management network may be utilized to manage the processor. Anaction request may be received by the management controller over themanagement network. In some implementations, the action request may bewritten to the storage device 160.

In operation, an action request may be received by the managementcontroller. In some implementations the action request may be stored onthe storage device coupled to the management controller. The actionrequest may be received over the management network. The processorexecuting the operating system instructions may receive the actionrequest. In some implementations, receiving the action request mayinclude retrieving the action request from the storage device. In otherimplementations, the action request may be received by the managementcontroller and sent to the processor. The processor may execute theaction request. Execution of the action request may not require use ofthe production network.

FIG. 2 is another example of a system that may utilize managementcontroller action requests according to the techniques described herein.System 200 may include components that are similar to those describedwith respect to FIG. 1. Like components are similarly numbered. System200 may include a server computer 205. Many of the components describedin FIG. 1 may be included in the server computer 205. For example, theserver computer may include a processor 230, a non-transitory processorreadable medium 232, a storage device 265, a plurality of components,such as an Host Bus Adaptor (HBA) 240, a Network Interface Controller(NIC) 241, and Basic Input Output System (BIOS) 242. The server computermay also include a management controller 250 and storage device 260.Just as above, system 200 may include a production network 210 and amanagement network 220.

Server computer 205 may be utilized to process a workload. One exampleworkload may be a web server workload. Another example workload may be adatabase server workload. Techniques described herein are not dependenton any particular type of workload. What should be understood is thatserver 205 executes some desired workload processing functionalitythrough the use of processor 230. The server 205 may be connected to theexternal world through production network 210. For example, requests forworkload processing may be received over the production network and theresults of that workload processing may be returned over the productionnetwork.

The processor 230 may be coupled to a non-transitory processor readablemedium 232. The medium 232 may contain thereon a set of instructions,which when executed by the processor cause the processor to execute thefunctionality described herein. For example, the medium 232 may includeoperating system instructions 234 which cause the processor to implementan operating system domain 234-a on the server computer. Theinstructions may also include utility program instructions 236, whichmay cause the server to implement a utility program 236-a executingunder control of the operating system. The utility program may executewith operating system administrator privileges. Operation of the utilityprogram is described in further detail below.

The processor may also be coupled to storage device 265. Storage device265 may be any type of storage device, including non-volatile memory,such as flash memory, volatile memory, such as dynamic or static randomaccess memory (SRAM or DRAM), persistent memory, such as a hard or solidstate disk drive, or any other type of storage that may be used to storeaction data 266. Action data may be data used in the execution of anaction. For example, in the case of performing a firmware update, theaction data may include the updated firmware package that is to beinstalled. Use of the action data is described in further detail below.

The processor may also be coupled to a management controller 250. Asexplained above, the management controller may be used to executemanagement operations on the server 205. The management controller mayalso be coupled to a storage device 260. Storage device 260 may besimilar to storage device 265, with the exception that storage device260 may be written to from the management controller by a user that doesnot have administrator credentials. Storage device 260 may include anaction request 261, indicating that an action is to be performed by theutility program. Operation of the action request is described in furtherdetail below.

As above, the management controller 250 may be coupled to a managementnetwork 220 that is separate from production network 210. Thus, anybandwidth consumed on the management network does not impact thebandwidth available on the production network. For purposes ofdescription, FIG. 2 depicts two users. An administrator 270 is a userthat has administrator credentials and is able to exert full controlover the system. In other words, user 270 may be considered the rootuser. An action request user 280 is a user that does not haveadministrator credentials for server 205. However user 280 does have thepermissions needed in order to store an action request 261 on thestorage device 260 or to otherwise send an action request to themanagement controller 250. Although users 270, 280 are depicted as humanusers, it should be understood that the techniques described herein arenot limited to human users. The techniques are equally applicable in thecase where the actions of users 270, 280 are performed programmatically.

In operation, the administrator 270 may configure operation of theutility program 236-a. For example, the configuration may includedetermining how often the utility program is to check the storage device260 for the presence of an action request 261. The configuration mayalso include receiving action requests directly from the managementcontroller. The utility program may also be configured to perform theaction specified in the action request 261 at a specified time of day.The utility program may also be configured to allow the action requestto immediately trigger an action. The utility program may also beconfigured to reboot the server 205 at a specified time after executingthe action specified by the action request. What should be understood isthat administrator 270 controls configuration of utility program 236-a,and as such controls when an action request, including any associatedeffects on the availability of the system, is executed.

The action request user 280 may store an action request 261 on storagedevice 260 by accessing that storage device through the managementcontroller 250. The access may occur over the management network, suchthat no bandwidth on the production network is used. In someimplementations, the action request may bypass storage device 260 and besent directly to the utility program 236-a. The action request mayspecify a time at which the action is to be performed. For example, theaction request may specify that the action should be performed on orafter a particular time of a particular day. The action request may alsospecify that the action is to be performed immediately. However, as willbe explained in further detail below, the utility program 236-a, asconfigured by administrator 270, is the final arbiter of when an actionis to be performed.

The action request may be in the form of a script. The script mayinclude data that is used by the utility program in order to execute theaction. For example, in the case of an update of the firmware of thevarious peripherals 240-242 of the server 205, the action request scriptmay inform the utility program as to a storage location from which theupdated firmware may be retrieved. For example, the script may include anetwork location from where the updated firmware package may bedownloaded. For purposes of this description, data used in the executionof the action request is referred to as action data 266. In the case ofa firmware update, the action data may be the updated firmware package.However, techniques described herein are not limited to firmware updatesonly. Any type of action which may need administrator credentials couldmake use of the techniques described herein. For example, the actionrequest may be a list of configuration settings and the utility programknows how to apply those settings to the server 205.

The utility program 236-a may download any needed action data to thestorage device 265 though the management controller 250 and themanagement network 220. Thus, downloading the action data does notconsume any bandwidth on the production network, leaving that bandwidthavailable for processing the workload that is assigned to the server.

In order to aid in the description of the techniques presented herein,an example of a driver update is described. For example, the driverupdate may be to update the HBA 240, NIC 241 or BIOS 242. For purposesof this description, it should be assumed that administrator credentialsare needed in order to update the drivers. It should also be assumedthat the action request user 280 does not possess the administratorcredentials, even though the action request user is authorized torequest updates to the server. It should be understood thatadministrator 270 remains in control of if and/or when the actionrequest is executed through the configuration of the utility program236-a.

The process may start with the update user writing an action request 261to the storage device 260. The update user may access the storage device260 via the management controller 250. Administrator credentials may notbe needed to write the action request to the storage device. In analternate example, the action request may be sent from the managementcontroller to the utility program, thus bypassing the storage device.The action request may specify the action to be performed. In thepresent example, the action to be performed may be a firmware update toone or more of the plurality of components described above. However, itshould be understood that the action request could be any of thedifferent types of updates mentioned above. The action request may be inthe form of a script. The script may specify the action to be performedand the location of any action data 266 needed to perform the action. Inaddition, the script may specify a time when the action is to beperformed. For example, the script may specify that the action is to beperformed after a defined time. Alternatively, the script may specifythe action is to be performed immediately. Although the action scriptmay specify a time that the action is to be performed, it should beunderstood that this time is when the action request user prefers thatthe update is to be performed. Final determination of when the action isactually performed is based on the configuration of the utility program236-a, as configured by the administrator user 270.

As mentioned above, in one implementation, the utility program isconfigured by the administrator user 270 to periodically check thestorage device 260 for the presence of an action request 261. Theparticular period is relatively unimportant to the techniques describedherein. For example, the period may be every minute, every five minutes,hourly, daily, weekly, monthly, or any other period. In otherimplementations, the action request may be sent directly from themanagement controller to the utility program. Upon determining that anaction request is available, the utility program may determine when theaction is to be performed.

Determining when the action is to be performed may include determiningif any specified time is included in the action request. For example,the action request may desire that the action is performed immediately(e.g. in the case of a security update, it may be desirable to apply theupdate as quickly as possible). The action request may alternativelyspecify that the action should be performed after a specified time (e.g.update after midnight on Friday). Regardless of when the action requestspecifies that the action is to be performed, it should be understoodthat this is simply an input into the utility program. The utilityprogram makes the final determination as to when the action request isto be performed.

While waiting for the determined time to arrive, the utility program maydownload any needed action data 266 to storage device 265. For example,in the case of a firmware update, the action data may be the updatedfirmware package. The utility program may download the action data tothe storage device by utilizing the management network 220. Thus, nobandwidth on the production network 210 is used to download the actiondata. As mentioned previously, the action request 261 itself may specifythe location of the action data. Thus, the utility program need not knowin advance the location of the action data.

Upon arrival of the determined time, the utility program may initiatethe action request. For example, in the case of a firmware update, theutility program may begin the update process. The utility program maymake use of the action data 266 that had been previously downloaded.However, it should be understood that downloading the action data inadvance is not required. In some example implementations, the actiondata may not be downloaded until the determined time has arrived. Insome implementations, the utility program may write an indicator to thestorage device 260 to indicate that the action request is in progress.The action request user 280 may retrieve this indication to determine ifthe action request is in progress.

It should be understood that the utility program is able to run withadministrator privileges. Thus, even though the action request wasinitiated by the action request user 280 who has privileges to accessthe management controller, but who does not have administratorprivileges, the action is performed using administrator credentials. Assuch, the action request user was able to initiate an action on theserver 205 that needs to execute with administrator credentials withoutthe administrator credentials every being provided to the action requestuser.

Some action requests may need the server 205 to restart in order to takeeffect. The utility program may be configured by the administrator user270 to specify when a restart is to actually occur. Thus theadministrator user 270 remains in charge of any period of unavailabilityof the server due to processing the action request. In someimplementations, once the action request is completed, including anyrestart if needed, the utility program may write an indication ofcompletion to the storage device 260. The action request user 280 mayretrieve this indication to determine if the action request hascompleted.

FIG. 3 is an example of a high level flow diagram for retrieving andexecuting an action according to the techniques described herein. Inblock 310, a utility program operating under the control of an operatingsystem on a server computer may receive an indication of an actionrequest. For example, the action request may be in the form of a script,as described above. The action request may have been received by amanagement controller. For example, the action request indication mayhave been received by the management controller and stored in anon-volatile memory associated with the management controller. In otherexamples, the action request may bypass storage, and be sent directlyfrom the management controller to the utility program.

Receiving the action request by the management controller may notrequire server operating system administrator credentials. In otherwords, the action request indication may be received by the managementcontroller and, in some implementations, stored on the managementcontroller accessible storage, by an entity (either a person or program)that does not have administrator credentials for the operating systemrunning on the server. In block 320, an action specified in the actionrequest may be executed by the utility program. The utility program mayrun with operating system administrator credentials, thus allowingcompletion of actions that require operating system administratorcredentials.

FIG. 4 is another example of a high level flow diagram for retrievingand executing an action according to the techniques described herein. Inblock 410, just as above in block 310, a utility program operating underthe control of an operating system on a server computer may receive anindication of an action request. The action request may have received bya management controller. Receiving the action request in the managementcontroller may not require server operating system administratorcredentials.

In block 420, action execution support data may be downloaded to theserver computer over a management network. The management network may beisolated from the production network. In other words, any files or otherdata needed to complete the action request may be downloaded to theserver. This download may occur over the management network, and as suchdoes not consume any bandwidth on the production network. For example,in the case of a driver update, the updated driver files may bedownloaded to the server over the management network. It should beunderstood that the techniques described herein are not limited todriver updates and are applicable to any data needed in order to executethe action request.

In block 430, the utility program may determine when the action is to beexecuted. The action may not be executed until arrival of the determinedtime. As mentioned above, determining when the action is to execute mayinclude examining the action request itself as well as configurationparameters for the utility program. For example, the utility program mayspecify that the action is to be performed once a week, at a specifiedtime, unless the action request specifies a different level of urgency.What should be understood is that the utility program examines allconfiguration settings and information in the action request anddetermines when the action is to be executed.

In block 440, an action in progress indication may be written to themanagement controller accessible storage once the action beginsexecution. This ensures that should the action request fail for somereason, the utility program is made aware that the action had alreadybeen started, thus preventing the utility program from re-executing theaction request. In block 450, the action specified in the action requestmay be executed by the utility program. Execution of the action mayutilize the support data downloaded in block 420.

FIG. 5 is an example of a high level flow diagram for updating operatingsystem driver updates according to the techniques described herein. Inblock 510 an operating system driver update script may be retrieved froma management controller accessible storage device. For example, themanagement controller accessible storage device may be a non-volatilememory. The management controller may be separate from the processor,meaning that the system includes at least two separate processors. Oneof those processors being the management controller and at least oneother processor not dedicated to management functions.

The update script may be written to the management controller accessiblestorage device over a management network. As explained above, themanagement network may be separate from a production network. Bydownloading the script over the management network, no bandwidth on theproduction network is used.

In block 520, an OS update package may be downloaded from a locationspecified in the OS driver update script. The download may occur overthe management network. Just as above, because the download occurs overthe management network, no bandwidth on the production network is usedby the download of the update package. Furthermore, because the locationof the update package may be specified by the update script, it is notnecessary to know the location of the update package in advance. Inblock 530, the OS driver update may be initiated.

FIG. 6 is another example of a high level flow diagram for updatingoperating system driver updates according to the techniques describedherein. In block 610, a management controller accessible storage devicemay be periodically checked for the presence of an OS driver updatescript. In block 620, just as above in block 510, an operating systemdriver update script may be retrieved from a management controlleraccessible storage device. The management controller may be separatefrom the processor. The update script may be written to the managementcontroller accessible storage device over a management network. Themanagement network may be separate from a production network.

In block 630, as above in block 520, an OS update package may bedownloaded from a location specified in the OS driver update script. Thedownload may occur over the management network. Just as above, nobandwidth on the production network is used by the download of theupdate package. Also just as above, it is not necessary to know thelocation of the update package in advance, because it is specified inthe update script.

In block 640, a time when the OS driver update shall occur may bedetermined, The time may be determined based on a time included in theupdate script itself, a priority of the update, and the configuration ofthe update utility. In block 650, initiation of the OS driver update maybe delayed until the arrival of the determined time. In block 660, theOS driver update may be initiated. The OS driver update may includeupdating drivers with those contained in the OS update package that wasdownloaded in block 630. In block 670, an indication of OS driver updatecompletion may be written to the management controller accessiblestorage location upon completion of the OS driver update.

We claim:
 1. A method comprising: receiving, with a utility programrunning under the control of an operating system on a server computer,an indication of an action request, the indication of the action requestbeing received by a management controller, wherein receiving the actionrequest indication does not require server operating systemadministrator credentials; and executing an action specified in theaction request by the utility program.
 2. The method of claim 1 furthercomprising: downloading action execution support data to the servercomputer over a management network, wherein the management network isisolated from a production network.
 3. The method of claim 1 wherein theaction specified in the action request is a software update request. 4.The method of claim 1 further comprising: determining, by the utilityprogram, when the action is to be executed, wherein the action is notexecuted until arrival of the determined time.
 5. The method of claim 4wherein the action request may indicate immediate execution, theimmediate execution indication causing the utility program to expediteaction execution.
 6. The method of claim 4 wherein the action requestmay indicate delayed execution, the delayed execution indication causingthe utility program to delay action execution until after a timespecified in the action request.
 7. The method of claim 4 furthercomprising: writing an action in progress indication to the managementcontroller accessible storage once the action begins execution.
 8. Anon-transitory processor readable medium containing a set ofinstructions thereon, which when executed by a processor cause theprocessor to: retrieve an Operating System (OS) driver update scriptfrom a management controller accessible storage device, the managementcontroller being separate from the processor, the update script beingwritten to the management controller accessible storage device over amanagement network; download an OS update package from a locationspecified in the OS driver update script, the download occurring overthe management network; and initiating the OS driver update.
 9. Themedium of claim 8 wherein writing the driver update script to themanagement controller accessible storage device does not require OSadministrator credentials and initiating the OS driver update doesrequire OS administrator credentials.
 10. The medium of claim 8 furthercomprising instructions to: determine a time when the OS driver updateshall occur; and delay initiating the OS driver update until arrival ofthe determined time.
 11. The medium of claim 8 further comprisinginstructions to: periodically check the management controller accessiblestorage device for the presence of the OS driver update script.
 12. Themedium of claim 8 further comprising instructions to: write anindication of OS driver update completion to the management controlleraccessible storage device upon completion of the OS driver update.
 13. Asystem comprising: a management controller coupled to a managementnetwork; a first storage device coupled to the management controllerwherein an action request received over the management network is storedin the first storage device; and a processor coupled to the managementcontroller and a production network, wherein the processor executes anoperating system, retrieves the action request from the storage device,and executes the action request without use of the production network.14. The system of claim 13 further comprising: a second storage devicewherein data used in the execution of the action request is downloadedto the second storage device over the management network.
 15. The systemof claim 13 further comprising a plurality of devices coupled to theprocessor, wherein the action request is to update drivers associatedwith the plurality of devices, wherein writing the action request to thefirst storage device does not require administrator credentials, whereinexecuting the action request requires administrator credentials.